Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,055 alerts · page 37 of 53

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-107048 An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.

    CriticalCVSS 9.8 EPSS 0.54%

    Exploit status: No public exploit known

    An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-107043 Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.

    CriticalCVSS 9.1 EPSS 0.30%

    Exploit status: No public exploit known

    Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-107050 An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution.

    CriticalCVSS 9.8 EPSS 0.47%

    Exploit status: No public exploit known

    Affects: ubuntu/retroarch

    An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution.

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-107060 Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.

    CriticalCVSS 9.1 EPSS 0.28%

    Exploit status: No public exploit known

    Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-107058 An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.

    CriticalCVSS 9.8 EPSS 0.49%

    Exploit status: No public exploit known

    An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-107040 Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

    CriticalCVSS 9.1 EPSS 0.34%

    Exploit status: No public exploit known

    Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-107021 Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire me...

    CriticalCVSS 9.1 EPSS 0.34%

    Exploit status: No public exploit known

    Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database.

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-107045 Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.

    CriticalCVSS 9.1 EPSS 0.34%

    Exploit status: No public exploit known

    Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-107034 Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data.

    CriticalCVSS 9.1 EPSS 0.37%

    Exploit status: No public exploit known

    Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data.

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-107053 Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox.

    CriticalCVSS 9.1 EPSS 0.36%

    Exploit status: No public exploit known

    Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox.

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-107038 Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.

    CriticalCVSS 9.1 EPSS 0.37%

    Exploit status: No public exploit known

    Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.

  14. Critical (CVSS 9+) Published · updated

    CVE-2026-107056 Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database v...

    CriticalCVSS 9.1 EPSS 0.27%

    Exploit status: No public exploit known

    Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message.

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-79589 The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerability is caused by the exposure...

    CriticalCVSS 9.8 EPSS 0.35%

    Exploit status: No public exploit known

    The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerability is caused by the exposure of the UART debugging interface having a lack of authentication, authorization...

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-118579 D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor

    CriticalCVSS 9.3 EPSS 0.79%

    Exploit status: No public exploit known

    Affects: d-link dir-505

    A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is possible to be carried o...

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-61567 AVideo-Encoder: unauthenticated command execution through streamer login trust

    CriticalCVSS 10.0 EPSS 0.53%

    Exploit status: No public exploit known

    Affects: WWBN AVideo-Encoder

    AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker...

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-61564 AVideo-Encoder: unauthenticated installer PHP code injection

    CriticalCVSS 10.0 EPSS 0.54%

    Exploit status: No public exploit known

    Affects: WWBN AVideo-Encoder

    AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).